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AMENDMENTS TO THE CLAIMS : 

1 . (Currently Amended) A system for early warning in an e-service management system, 
comprising: 

a statistical learning mechanism for performing statistical learning based on a plurality of 
data values of a variable to generate a statistical model characterizing the behavior of the 
variable; 

an early warning mechanism for generating an early warning of threshold violation of the 
variable with respect to a threshold by predicting, based on a plurality of residuals corresponding 
to different time reference points in the future based on the statistical model, the statistical 
mod e l, a future time by which the values of the variable exceeds the threshold; and 

an operational mechanism for detecting abnormal behavior of the variable based on both 
the statistical model and the early warning. 

2. (Previously Presented) The system according to claim 1, wherein the statistical 
learning mechanism comprises: 

an offline normal behavior modeling mechanism for modeling the regular behavior of the 
variable based on the plurality of values of the variable collected offline over a period of time; 
and 

an online behavior modeling mechanism for modeling the dynamic behavior of the 
variable based on a plurality of values of the variable collected online during the operations 
performed by the operational mechanism. 

3. (Currently Amended) A method for early warning in an e-service management system, 
comprising: 



Application No.: 09/902,094 Docket No.: 8827.012.00-US 

Amendment filed on February 3, 2005 

Reply to Office Action dated November 3, 2004 

modeling the behavior of a variable based on a plurality of data values of the variable 
collected over a period of time, said modeling being performed based on the statistical properties 
of the data values of the variable to generate a behavior model for the variable, the behavior 
model being represented using a plurality of model parameters; 

generating an early warning for a threshold violation of the variable with respect to a 
threshold based on a plurality of data values of the variable collected online and the behavior 
mode L the generating an early warning including computing a plurality of residuals 
corresponding to different time reference points in the future based on the model parameters ; and 

detecting abnormal behavior of the variable according to the plurality of data values of 
the variable collected online and the early warning. 

4. (Original) The method according to claim 3, wherein the modeling comprises: 
establishing, by an offline normal behavior modeling mechanism, a first statistical model 

that characterizes the regular behavior of the variable based on a first set of values of the variable 
collected offline over a period of time; and 

establishing a second statistical model that characterizes the dynamic behavior of the 
variable based on a second set of values of said variable collected online, said first and said 
second statistical model comprising said behavior model. 

5. (Currently Amended) The method according to claim 3, wherein generating an early 
warning further includes comprises : 

computing a plurality of r e siduals at corresponding different tim e r e f e r e nc e points in tho 
future bas e d on th e model paramet e rs; 

deriving the variances of the plurality of residuals, predicted by said predicting; 
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estimating the probabilities for threshold violation of the variable with respect to said 
threshold at the corresponding different time reference points in the future; and 

issuing an early warning for any of the time reference points at which the probability for 
threshold violation of the variable exceeds a pre-determined value. 

6. (Currently Amended) The method according to claim 5, wherein the estimating the 
probabilities comprises: 

translating tho threshold for the variabl e to corr e sponding deriving a residual threshold 
[[for]] corresponding to the residual of the variable; and 

calculating the probabilities for threshold violation of the residual with respect to the 
residual threshold at the corresponding different time reference points in the future. 

7. (Currently Amended) A computer-readable medium encoded with a program for early 
warning in an e-service management system, the program comprising: 

modeling the behavior of a variable based on a plurality of data values of the variable 
collected over a period of time, said modeling being performed based on the statistical properties 
of the data values of the variable to generate a behavior model for the variable, the behavior 
model being represented using a plurality of model parameters; 

generating an early warning for a threshold violation of the variable with respect to a 
threshold based on a plurality of data values of the variable collected online and the behavior 
model , the generating an early warning including computing a plurality of residuals 
corresponding to different time reference points in the future based on the model parameters ; and 

detecting abnormal behavior of the variable according to the plurality of data values of 
the variable collected online and the early warning. 
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8. (Original) The medium according to claim 7, wherein the modeling comprises: 
establishing, by an offline normal behavior modeling mechanism, a first statistical model 

that characterizes the regular behavior of the variable based on a first set of values of the variable 
collected offline over a period of time; and 

establishing a second statistical model that characterizes the dynamic behavior of the 
variable based on a second set of values of said variable collected online, said first and said 
second statistical model comprising said behavior model. 

9. (Currently Amended) The medium according to claim 7, wherein generating an early 
warning further includes comprises : 

computing a plurality of residuals corresponding to diff e rent tim e r e f e r e nc e points in the 
futur e based on th e mod e l param e t e rs; 

deriving the variances of the plurality of residuals, predicted by said predicting; 

estimating the probabilities for threshold violation of the variable with respect to said 
threshold at the corresponding different time reference points in the future; and 

issuing an early warning for any of the time reference points at which the probability for 
threshold violation of the variable exceeds a pre-determined value. 

10. (Currently Amended) The medium according to claim 9, wherein the estimating the 
probabilities comprises: 
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translating tho threshold for th e variabl e to corresponding deriving a residual threshold 
[[for]] corresponding to the residual of the variable; and 

calculating the probabilities for threshold violation of the residual with respect to the 
residual threshold at the corresponding different time reference points in the future. 

1 1 . (Previously Presented) The system as claimed in claim 1 , wherein the thresholds 
corresponding to future times are distinct based on time of day and day of week. 

12. (Previously Presented) The system as claimed in claim 1 5 wherein the detection of 
abnormal behavior is further based on criteria derived from a business process model. 

13. (Previously Presented) The system as claimed in claim 2, wherein the online behavior 
modeling mechanism includes a sliding window. 

14. (Currently Amended) The system as claimed in claim 13, wherein the sliding window 
is used to determine stationarity segments in which the variable includes stochastically stationary 
behavior s e gments of th e variabl e and the times corresponding to boundaries of the stationarity 
stationary segments. 

15. (Previously Presented) The system as claimed in claim 13, wherein the width of the 
sliding window is configurable parameter. 

16. (Currently Amended) The method as claimed in claim 3, wherein the modeling of the 
behavior of the variable includes detecting time segments in which the variable includes 
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stochastically stationary behavior segm e nts of stationarity and the times corresponding to the 
boundaries of the time thes e stationarity segments. 

17. (Previously Presented) The method as claimed in claim 3, wherein detecting 
abnormal behavior of the variable is further according to criteria derived from a business process 
model. 

18. (Previously Presented) The method as claimed in claim 5, wherein the residuals 
corresponding to different time points in the future comprise a distinct value depending on the 
time of day, day of week, and week of month of the future time. 

19. (Previously Presented) The method as claimed in claim 5, wherein the number of time 
reference points and the pre-determined threshold violation value are configurable parameters. 

20. (Previously Presented) The method as claimed in claim 5, wherein the number of time 
reference points and the pre-determined threshold violation value are derived from a business 
process model. 

21. (Previously Presented) The computer-readable medium as claimed in claim 7, 
wherein the threshold is further based on criteria derived from a business process model. 

22. (Previously Presented) The computer-readable medium as claimed in claim 7, 
wherein the threshold is a distinct value based on time of day and day of week. 
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23. (Currently Amended) The computer-readable medium as claimed in claim 8, wherein 
the modeling of the behavior of the variable includes detecting time segments in which the 
variable includes stochastically stationary behavior of stationarity and the times corresponding to 
the boundaries of [[these]] the time stationarity segments. 

24. (Previously Presented) The computer-readable medium as claimed in claim 8, 
wherein modeling of the behavior of the variable includes the use of a sliding window. 
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